Semantic watermarks that travel from retrieved images to generated answers, without changing the RAG model.
The challenge
99.61%
Conditional generation success
MMQA · acronym watermarks
Qwen2.5-VL 7B · Table 1
96.68%
Conditional generation success
WebQA · acronym watermarks
Qwen2.5-VL 7B · Table 1
≤30
Queries for significant evidence
Both watermark types · p < 0.05
Reported experiment · Fig. 4(a)
RAG services use shared knowledge bases to answer users' questions. A data provider may contribute valuable images without being able to inspect the service's models or its internal knowledge base.
AQUA inserts a small set of synthetic watermark images. Their semantic signals survive retrieval and appear in textual answers, giving the data provider a practical way to test for the use of its knowledge through the service's query interface.
The paper
As Retrieval-Augmented Generation (RAG) evolves into service-oriented platforms (RAG-as-a-Service) with shared knowledge bases, protecting the copyright of contributed data becomes essential. Existing watermarking methods in RAG focus solely on textual knowledge, leaving image knowledge unprotected.
In this work, we propose AQUA, the first watermark framework for image knowledge protection in Multimodal RAG systems. AQUA embeds semantic signals into synthetic images using two complementary methods: acronym-based triggers and spatial relationship cues. These techniques ensure watermark signals survive indirect watermark propagation from image retriever to textual generator, being efficient, effective and imperceptible. Experiments across diverse models and datasets show that AQUA enables robust, stealthy, and reliable copyright tracing, filling a key gap in multimodal RAG protection.
Methodology
Construct an image–query pair whose answer is unlikely to appear by chance, but easy to recover when the watermark image is retrieved.
01 · Acronym-based watermark
AQUA chooses an uncommon acronym and links it to its expanded phrase in a synthetic image. A probe asks about the acronym; the expected phrase becomes the ownership signal in the generated answer.
UGP → “Unicorn Grammar Parser”
02 · Spatial-based watermark
AQUA builds an image with an unexpected relationship between familiar objects. The probe directs the generator to describe that relationship, carrying a visual ownership signal into its text response.
A monkey using a banana as a telephone.
Pair each semantic watermark image with a probe query and an expected answer.
Add watermark images to the image knowledge base. The retriever and generator remain unchanged.
Query the service and use statistical evidence from its answers to test for watermark presence.
Experiments
Selected effectiveness results from Table 1. Conditional generation success rate (CGSR) measures success when the watermark image is retrieved.
| Dataset | Generator | Watermark | CGSR (%) | Rank |
|---|---|---|---|---|
| MMQA | Qwen2.5-VL-Instruct 7B | Naive | 38.15 | 2.86 |
| MMQA | Qwen2.5-VL-Instruct 7B | Opt. | 19.96 | 1.45 |
| MMQA | Qwen2.5-VL-Instruct 7B | AQUA acronym | 99.61 | 1.03 |
| MMQA | Qwen2.5-VL-Instruct 7B | AQUA spatial | 98.42 | 1.29 |
| MMQA | Qwen-VL-Chat 7B | Naive | 15.79 | 2.86 |
| MMQA | Qwen-VL-Chat 7B | Opt. | 21.29 | 1.45 |
| MMQA | Qwen-VL-Chat 7B | AQUA acronym | 75.28 | 1.03 |
| MMQA | Qwen-VL-Chat 7B | AQUA spatial | 78.92 | 1.29 |
| WebQA | Qwen2.5-VL-Instruct 7B | Naive | 15.87 | 4.56 |
| WebQA | Qwen2.5-VL-Instruct 7B | Opt. | 18.51 | 1.90 |
| WebQA | Qwen2.5-VL-Instruct 7B | AQUA acronym | 96.68 | 1.05 |
| WebQA | Qwen2.5-VL-Instruct 7B | AQUA spatial | 89.85 | 1.85 |
| WebQA | Qwen-VL-Chat 7B | Naive | 5.71 | 4.56 |
| WebQA | Qwen-VL-Chat 7B | Opt. | 18.91 | 1.90 |
| WebQA | Qwen-VL-Chat 7B | AQUA acronym | 77.86 | 1.05 |
| WebQA | Qwen-VL-Chat 7B | AQUA spatial | 68.46 | 1.85 |
CLIP retriever. Values are reported in the paper and are not a live benchmark. Full Table 1, including LLaVA-NeXT and InternVL3.
In the reported query-efficiency experiment, both AQUA variants require at most 30 verification queries to reach p < 0.05. The optimization baseline needs more than 200 queries.
The original curve also shows how the p-value falls as the query budget increases. A lower p-value gives stronger statistical evidence of watermark presence.
The study checks watermark retrieval and signature generation under normal queries, and compares outputs for related queries.
Section 5.4The study checks retrieval frequency under normal queries and compares watermark and ordinary image embeddings.
Section 5.5The experiments cover image distortions and regeneration attacks, including rescaling, rotation and Gaussian noise.
Section 5.6For your research
If AQUA is useful in your research, please cite our ICLR 2026 paper.
@inproceedings{ICLR2026_d7a2222b,
title={Safeguarding Multimodal Knowledge Copyright in the
RAG-as-a-Service Environment},
author={Chen, Tianyu and Lou, Jian and Wang, Wenjie},
booktitle={International Conference on Learning Representations},
year={2026},
url={https://proceedings.iclr.cc/paper_files/paper/2026/file/d7a2222b8d41014e060cfeb0995501d0-Paper-Conference.pdf}
}